Relay accepts private reports for security issues.

• Email: support@onrelay.app
• Subject: Security report
• Include reproduction steps, affected surface, and any proof-of-concept details.

Please do not open public issues for security-sensitive reports.

• We will acknowledge a report as soon as practical.
• Valid reports are triaged privately.
• Fix timing depends on severity, exploitability, and user impact.

• Production web app
• MCP server and installer packages
• Authentication, billing, memory, and context-sync surfaces
• Browser extension behavior, once extension-specific work is explicitly in scope